What is Explorer.exe

Windows Explorer - Microsoft® Windows® Operating System - Microsoft Corporation

File description

Explorer.exe with description Windows Explorer is a process file from company Microsoft Corporation belonging to product Microsoft® Windows® Operating System.
The file is digitally signed from Microsoft Windows Component Publisher - Microsoft Timestamping Service
We do not recommend removing digitally signed files from Microsoft Windows Component Publisher

What is explorer.exe?
Windows Explorer, or explorer.exe, is the default Windows user shell. This process is responsible for the file manager, desktop, and taskbar. As such, it is arguably the most readily apparent process in Windows. The following screenshot shows the taskbar and an Explorer window, both of which are part of Windows Explorer:

Despite its ubiquity, Explorer can be safely terminated. Doing so, however, will prevent you from launching any programs via the graphical user interface (as your taskbar, start menu, and icons will be gone). The screenshot below illustrates how explorer.exe should appear in the task manager:

Notice that this process always runs as the current user (in this case, Mike). An explorer.exe process running as a user such as SYSTEM may be indicative of malware; however, a copy of this process running as the current user does not necessarily mean that the process is legitimate.

Dangers of explorer
As this is a ubiquitous process that is running on any system on which one wishes to use the graphical user interface, it is extremely common for virus writers and spyware vendors to disguise their malware as the genuine Explorer.

Some malicious files will have the same name as this process but will be stored somewhere other than in %SystemRoot%. Other malware will use a name that appears similar to it but with slight differences in spelling or with appended digits. The following malware is known to disguise itself as Explorer:
  • W32.MyDoom
    • This is a common worm, some variants of which have a backdoor trojan component.
  • W32.SCKeyLog
    • A keylogger that installs itself in %SystemRoot%\System32
  • explorer32.exe
    • This process indicates the presence of one or more instances of a variety of viruses and/or spyware. Some common causes of explorer32.exe are W32.KWBot-A, StartPa-MN, and several keyloggers.
There will typically be only one copy of this process running at a given time for a given user. If multiple copies are running, one or more of the instances may be malware.

Common problems
  • "Windows Explorer has encountered a problem and needs to close"
    • If this only happens occasionally, it is not cause for concern.
    • If Explorer crashes when browsing a folder that contains media items, a faulty codec could be to blame. Uninstall any additional codecs that you have installed and try again.
    • If the problem persists, perform a repair installation of Windows.
  • Explorer.exe uses 100% CPU time
    • This can occur when Windows is looking for network folders. Try disabling "Automatically search for network printers and folders" by opening an Explorer window and going Tools -> Folder Options -> View
    • As a workaround, open the Task Manager and kill explorer.exe. Click on File -> New Task (Run...) and type "explorer" (without quotes).

Automatic startup locations

001 Running Processes
002 Autorun registry entries local machine
003 Autorun registry entries Current User
004 All users startup startmenu
005 Current user startup startmenu
006 Start Menu\Programs\Startup
007 Roaming Start Menu\Programs\Startup
008 Autorun registry entries Default user
009 Autorun registry entries SYSTEM user
010 Installed services
012 Autorun registry entries S-1-5-XX users
013 RunOnce registry entries S-1-5-XX users
033 Winlogon Userinit
034 Winlogon Shell
035 Active Setup Installed Components
063 BootExecute
065 Image File Execution Options (debugger)
073 %windir%\Tasks
138 Local Machine RunonceEx (+subkeys)
140 Windows\run
146 AlternateShell
153 HKLM Drivers32\Midi
162 HKLM Policies\System\Shell
163 HKCU Policies\System\Shell
166 HKCU Policies\Explorer\Run
167 HKLM Policies\Explorer\Run
171 Screensaver

Digital signatures found for this file

140 Microsoft Windows Component Publisher - Microsoft Timestamping Service
73 Microsoft Windows - Microsoft Time-Stamp Service
44 Microsoft Windows Publisher - VeriSign Time Stamping Services Signer
37 Microsoft Windows XP Publisher - VeriSign Time Stamping Service
22 Microsoft Windows 2000 Publisher - VeriSign Time Stamping Service
15 Microsoft Windows XP Publisher - VeriSign Time Stamping Services Signer
13 Microsoft Windows XP Publisher (Europe) - VeriSign Time Stamping Service
8 Microsoft Windows - Microsoft Timestamping Service
7 Microsoft Windows Publisher - VeriSign Time Stamping Service
7 Microsoft Windows Component Publisher - VeriSign Time Stamping Services Signer
3 Bleeping Computer, LLC. - Certum Time-Stamping Authority
3 Microsoft Corporation - Microsoft Timestamping Service
3 Microsoft Windows - VeriSign Time Stamping Services Signer
2 Microsoft Windows 2000 Publisher (Europe) - VeriSign Time Stamping Service
2 Microsoft Windows 2000 Publisher (Europe) - VeriSign Time Stamping Service CA SW1

MD5 security rating in our database

4445 files (Not yet rated and not signed)
9 files (Not yet rated and digitally signed)
15 files (Safe and not signed)
450 files (Safe and digitally signed)
Some versions of this filename have not yet been checked for safety.
Warning: Some malware might rename itself to explorer.exe. Always make sure that your file is from a verified publisher.

User ratings for this file

File rating: Average rating of explorer.exe: by 4919 files and users.

Application errors

Fix explorer.exe application error:  Run a FREE registry scan

User comments

There are no user comments yet for this file.

Please add your comments if you have more information about this file or if you know how to solve explorer.exe application errors.

File safety :

File security rating :

Are you human? How much is 5+24:

Like this page?

Please support this free service by giving us a Google+1

Browse files by letter


More system processes

explorer_tweaked.exe Explorer1.exe explorer2.exe
explorer32.exe Explorer66.exe explorerband.dll
explorerbar.dll explorerch.exe explorerclient.exe
ExplorerExt.dll ExplorerExtension.dll ExplorerExtensions.dll

Lansweeper computer inventory From the creator of Runscanner:

is an automated IT asset management tool. It can quickly scan your computers and has over 250 default reports available.

There is no need to install any agents on the scanned computers, all hardware and software inventory scanning is done by standard build-in functionality.